Hi, try arpwatch... this will log machines, on the same subnet, that change IP add....
Chino --- bodgie <[EMAIL PROTECTED]> wrote: On Thu, 27 May 2004 16:35:29 +0800, william villanueva <[EMAIL PROTECTED]> wrote: > Will check into that. Does this use the same calls as "arp -a"? I was > testing this but not all the connection showed up. One came up as > "incomplete". This is based on my experience (I am not aware of the standards for ARP.) An "incomplete" entry would mean that the last attempt to contact the given IP was unsuccessful, i.e. there was no response to the ARP who-has request. This means that the machine was temporarily unreachable on the network. You can try it out by pinging a non-existing IP on your subnet. An "unavailable" entry would appear for a while, but will disappear soon. Also, IP addresses with no traffic get removed from the arp table after some time (does anybody know how long? is there a standard on this?). It doesn't mean that the host isn't there anymore though. One ping or any traffic will make it reappear in the arp table. -- Philippine Linux Users' Group (PLUG) Mailing List [EMAIL PROTECTED] (#PLUG @ irc.free.net.ph) Official Website: http://plug.linux.org.ph Searchable Archives: http://marc.free.net.ph . To leave, go to http://lists.q-linux.com/mailman/listinfo/plug . Are you a Linux newbie? To join the newbie list, go to http://lists.q-linux.com/mailman/listinfo/ph-linux-newbie _____________________________________________________________ Visit Atenista.Net, Your Portal to the Atenean Community! Click here: http://www.atenista.net -- Philippine Linux Users' Group (PLUG) Mailing List [EMAIL PROTECTED] (#PLUG @ irc.free.net.ph) Official Website: http://plug.linux.org.ph Searchable Archives: http://marc.free.net.ph . To leave, go to http://lists.q-linux.com/mailman/listinfo/plug . Are you a Linux newbie? To join the newbie list, go to http://lists.q-linux.com/mailman/listinfo/ph-linux-newbie
